netplex {
  controller {
    max_level = "debug";    (* Log level *)

    (* configure "admin" socket directory, default "/tmp/.netplex" *)
    (*
    socket_directory = "/tmp/.netplex";
    *)

    logging {
      (* type can either be "stderr", "syslog", "file", "multi_file"
       * see http://projects.camlcity.org/projects/dl/ocamlnet-3.6/doc/html-main/Netplex_admin.html
       *)
      type = "stderr";      (* Log to stderr *)
    };
  };
  service {
    name = "PKCS#11 Filtering Proxy";
    (* These parameters can be used to change UID/GID of worker processes *)
    (*
    user = "root";
    group = "root";
    *)

    (* Do NOT change conn_limit, this would be a serious SECURITY ISSUE *)
    conn_limit = 1;

    protocol {
      (* This section creates the socket *)
      name = "rpc_pkcs11";

      (* OCamlnet 4 support the following to set Unix socket permissions:*)
      (*
      local_chmod = "0o777";
      *)

      (* This section creates the socket *)
      (* Socket can either be TCP or UNIX *)
      address {
        type = "local";
        path = "/var/run/pkcs11proxyd.socket";

      };
    };
    processor {
      (* This section specifies how to process data of the socket *)
      type = "rpc_pkcs11";

      (* libnames param is used when the proxy is compiled WITHOUT filtering support *)
      (* syntax is: libnames="<module_name>:<path_to_middleware>;<...>:<...>;"; *)
      (*
      libnames="softhsm:/usr/lib/softhsm/libsofthsm2.so;";
      *)

      (* filter_config is used to supply the filtering configuration when compiled in *)
      filter_config="/build/src/tests/integration/filter.conf";

      (*************** TLS support begin ***********************)
      (* use_ssl = false to disable SSL support on server side *)
      (* use_ssl = true to enable SSL support on server side   *)
      use_ssl = true;

      (* TLS support for Caml Crush compiled with OCamlnet 4.x *)
      (* Uncomment to enable TLS when using OCamlnet 4.x *)

      tls {
        (* Ciphersuites, GnuTLS syntax *)
        (* TLS 1.2, PFS-only suites, no DSS, no CAMELLIA *)
        algorithms = "SECURE256:+SECURE128:-VERS-TLS-ALL:+VERS-TLS1.2:-RSA:-DHE-DSS:-CAMELLIA-128-CBC:-CAMELLIA-256-CBC";

        (* Force peer client authentication *)
        peer_auth = "required";

        (* Uncomment to enable DHE parameters, used for PFS *)
        (*
        dh_params {
          (* Pre-computed DH parameters *)
          pkcs3_file = "/etc/pkcs11proxyd/dhparams.pem";
          (* Run-time created DH parameters, warning: this takes a long time *)
          (*bits = 2048;*)
        };
        *)
        x509 {
         key {
           crt_file = "server.pem";
           key_file = "server-key.pem";
         };
         trust {
           crt_file = "ca.pem";
         };
        }
      };

      (***************TLS support end  *************************)

    };
    workload_manager {
      type = "dynamic";
      max_jobs_per_thread = 1;  (* Everything else is senseless *)
      min_free_jobs_capacity = 1;
      max_free_jobs_capacity = 1;
      max_threads = 100;
    };
  }
}
